COLUMBIA FINANCIAL, INC. CODE OF ETHICS AND BUSINESS CONDUCT

TABLE OF CONTENTS Page I. Our Code of Ethics and Your Responsibilities A. To Whom the Code Applies 1 B. Our Responsibilities 2 C. Asking Questions and Raising Concerns 2 D. Investigating Concerns 3 E. Consequences of a Violation 3 F. Protection from Retaliation 4 G. Supporting/Related Policies and Procedures 4 H. Waivers 4 I. Prior Approvals 5 J. Amendments 5 II. Financial Information, Records and Disclosures A. Accurate Record Keeping and Accounting 6 B. Public Disclosure 6 C. Accounting Practices 6 D. Cooperation with Inquiries 7 III. Protecting Columbia’s Assets A. Use of Company Assets 7 B. Authority to Make Commitments 7 C. Use of Columbia Technology 7 IV. Handling Confidential Information A. What is Confidential Information 8 B. Non-Disclosure and Non-Use 9 C. Privacy of Customer Information 9 D. Public Disclosures/Media/Public Appearances 9 E. Proper Disclosures 10 F. Prohibition Against Internet/Social Media Disclosure 10 G. Insider Trading 10 V. Conflicts of Interest and Related Policies A. Conflicts of Interest 11 B. Corporate Opportunities 12 C. Outside Director, Officer and Trustee Positions 12 VI. Employment Practices A. Equal Employment Opportunity 13 B. Harassment and Discrimination 13 C. Workplace Violence 13 D. Illegal and Impairing Substances 13

Page VII. Compliance with Laws and Regulations A. Our Regulatory Environment 14 B. Suspicious Activity 14 C. Examinations, Government Investigations and Litigation 14 D. Compliance with Antitrust Laws 15 E. Political Contributions and Activities 15 F. Bribes, Illegal Payments, Gifts and Gratuities 16 NOTE: Throughout the Code of Ethics and Business Conduct, Columbia refers to Columbia Financial, Inc. and/or the subsidiary or division in which an employee works, or for which a director serves, depending on context. In this Code, the terms “we,” “us,” and “our,” refer to Columbia Financial, Inc., Columbia Bank and their subsidiaries. The terms “you” and “your” refer to the individuals who are subject to the Code.

1 I. Our Code of Ethics and Your Responsibilities Our Code of Ethics and Business Conduct (at times, “Code”) sets forth principles and concepts that govern the actions of all persons affiliated with Columbia Financial, Inc. and its subsidiaries (collectively, “Columbia”). It is not a replacement for policies and procedures that address the specifics of our business or that may impose stricter or more detailed requirements. The Code is intended to be read in conjunction with these documents. Each of you are responsible for being familiar and complying with all of Columbia’s policies and procedures. Our Code is designed to promote: • honest and ethical conduct • full, fair, accurate, timely and understandable disclosure in the reports and documents we file and in the public communications we make • compliance with applicable laws, rules and regulations No code of conduct can cover every potential situation. It is, therefore, your responsibility to base your business conduct in accord with the principles set forth in this Code and with the exercise of good business judgment. If you have questions regarding the Code or what to do in a particular situation, speak with your manager or seek guidance from any of the resources identified in this Code. The Ethics Committee of Columbia has the final responsibility for administration and enforcement of this Code. A. To Whom the Code Applies Our Code of Ethics and Business Conduct provides ethical guidelines and expectations for all officers, employees, contractors and members of Columbia’s Board of Directors, and extends to all of Columbia’s direct and indirect subsidiaries. Certain parts of this Code may apply specifically to “executive officers.” Executive officer means a member of Columbia (including Columbia Bank and any subsidiary thereof) management so designated by resolution of the Board of Directors. Our vendors, service providers, consultants and other representatives are expected to adhere to the spirit of the Code when working on behalf of Columbia.

2 B. Our Responsibilities Each of us has an obligation to: • Comply with this Code, which requires honest and ethical conduct, prohibits violation of laws and regulations applicable to our businesses, and requires compliance with all Columbia policies; • Be familiar with laws and Columbia policies applicable to our job and communicate them effectively to team members; • Ask questions if a policy or the action to take in a specific situation is unclear; • Be alert to indications and/or evidence of possible wrongdoing; and • Report violations and suspected violations of this Code to the appropriate person as described in “Asking Questions and Raising Concerns” below and elsewhere in this Code. Supervisors/managers have a responsibility to model the highest ethical standards and create a work environment that values ethical conduct and integrity. They also have a particular responsibility to notice and question incidents, circumstances and behaviors that point to a reasonable possibility that a violation of this Code has occurred. The failure of a supervisor/manager to follow up on reasonable questions is, in itself, a violation of Columbia policy. Each of us is required to acknowledge and complete training on this Code upon hire and at regular intervals. In addition, we are required to acknowledge this Code annually. C. Asking Questions and Raising Concerns Whenever possible, you should work with your immediate supervisor or manager to get answers to routine questions. If a supervisor’s/manager’s answer does not resolve a question or if you have a question that you cannot comfortably address to your supervisor/ manager, you should go to a member of the Ethics Committee. If you see something that is unethical or illegal or that is inconsistent with the values expressed in this Code, immediately report your concerns to your supervisor/manager or the appropriate reporting channel. You may also ask a question or report issues by contacting: • Members of the Ethics Committee Mayra L. Rinaldi (Chairperson) Thomas J. Kemly John Klimowich • Columbia’s Hotline at (866) 861-4527 or at ColumbiaFinancial@integritycounts.ca

3 • Via the Internet at https://www.integritycounts.ca/org/ColumbiaFinancial Columbia’s Hotline is an attended line, managed for Columbia by an independent company that provides reporting services for numerous companies. It is available 24 hours a day, seven days a week. Concerns regarding questionable accounting, internal control or auditing matters should be handled under the procedures for confidential, anonymous submissions established by the Audit Committee as set forth in Columbia’s Procedures for Handling Complaints Regarding Accounting, Internal Controls and Auditing Matters. You may report your concerns confidentially and anonymously. However, we encourage you to provide contact information with your submission to facilitate follow-up, clarification and assistance with any investigation, if necessary. D. Investigating Concerns We will investigate concerns promptly and thoroughly. If the alleged violation of this Code concerns an executive officer or director, determination of whether a violation has occurred should be made by the Ethics Committee, in consultation with the Audit Committee of the Board of Directors, and such external legal counsel as may be appropriate. If the alleged violation concerns any other employee, the determination of whether a violation has occurred shall be made by the Ethics Committee. In determining whether a violation of this Code has occurred, the committee or person making such determination may take into account to what extent the violation was intentional, the materiality of the violation from the perspective of either the detriment to Columbia or the benefit to the director, executive officer or employee, the policy behind the provision violated, and such other facts and circumstances as they shall deem reasonable and appropriate. Acts or omissions determined to be violations of this Code by other than the Audit Committee under the process set forth above shall be promptly reported by the Ethics Committee to the Audit Committee and by the Audit Committee to the Board. Reports of suspected violations will be kept confidential to the extent possible and consistent with the conduct of an appropriate investigation. E. Consequences of a Violation Employees who violate this Code, or who fail to report violations, of which they are aware or should have been aware, will subject themselves to disciplinary action up to and including dismissal.

4 F. Protection from Retaliation Retaliation in any form against an employee who has, in good faith, reported or provided information during an investigation of an alleged violation of this Code is prohibited and will not be tolerated. Nor will Columbia tolerate retaliation for appropriate reports of any suspected legal or regulatory violation to any government authority or investigative agency. Retaliation is any adverse employment action or other action that is likely to deter a reasonable person from raising a concern, submitting a complaint, participating in an investigation, or engaging in some other form of legally protected activity. Allegations of retaliation will be investigated. Any employee who has been found to have engaged in retaliation in violation of this Code will be subject to appropriate disciplinary action, up to and including termination of employment. G. Supporting/Related Policies and Procedures This Code does not contain all of the policies of Columbia or all of the details of the policies that are included. Columbia has written policies and procedures that provide more information on some of the topics in this Code of Ethics and Business Conduct. Talk to your supervisor about Columbia’s policies and procedures that you are responsible for following in your job and make sure that you have reviewed and understand them. The following is a list of the principal policies and procedures and reference materials available in support of this Code: Privacy Policy Social Networking Policy Employee Manual Computer Usage Policy Whistleblower Policy Policy Regarding Insider Trading Procedures for Handling Complaints Regarding Accounting, Internal Controls and Auditing Matters Data Retention Policy H. Waivers You must request a waiver of a provision of this Code if there is a reasonable likelihood that your contemplated action will violate the Code. If a waiver request relates to an executive officer or director, the determination with respect to the waiver shall be made by the Ethics Committee in consultation with the Audit Committee of the Board of Directors, and external legal counsel as may be deemed

5 appropriate by such committee. Any waivers granted by such committee shall be submitted to the Board for ratification. Columbia will disclose publicly any waivers granted to directors and executive officers to the extent required by law or the rules of the Nasdaq Stock Market. If a waiver request relates to any other employee, the determination shall be made by the Ethics Committee unless the matter is quantitatively or qualitatively material or outside the ordinary course of business, in which case such determination shall be made by the Audit Committee. All waivers of this Code (other than those approved by the Audit Committee) shall be promptly reported to the Audit Committee. Waivers will not be granted except under extraordinary or special circumstances. I. Prior Approvals Whenever the requirement for prior approval appears in this Code, it means that a writing setting forth the pertinent facts of the situation under consideration shall be submitted according to the following process. If a request for prior approval relates to an executive officer or director, the determination with respect to the approval shall be made by the Ethics Committee, in consultation with the Audit Committee of the Board of Directors and external legal counsel as may be deemed appropriate by such committee. If a request for prior approval relates to any other employee, the determination shall be made by the Ethics Committee unless the matter is quantitatively or qualitatively material or outside the ordinary course of business, in which case such determination shall be made by the Audit Committee. All approvals (other than those approved by the Audit Committee) shall be promptly reported to the Audit Committee. J. Amendments The policies and procedures contained in this Code of Ethics and Business Conduct do not constitute a legal contract and may be changed, modified, or discontinued from time to time without notice (except as required by law) and in the sole discretion of Columbia Financial, Inc. Any amendment to the Code of Ethics that applies to Directors, Senior Financial Officers and Executive Officers must be approved by the Board of Directors, disclosed and reported on Form 8-K or otherwise as authorized by the SEC, within 5 business days.

6 II. Financial Information, Records and Disclosures A. Accurate Record Keeping and Accounting Columbia’s accounting records are relied upon to produce reports to Columbia’s management, shareholders, governmental agencies, and other entities. All Company accounting records and reports produced from those records shall be kept and presented in accordance with the laws of each applicable jurisdiction and must accurately and fairly reflect in complete and reasonable detail Columbia’s assets, liabilities, revenues, and expenses. Responsibility for accurate and complete financial records does not rest solely with Columbia’s accounting employees. All employees involved in approving transactions, supplying supporting information for transactions, and determining account classifications have responsibility for complying with this requirement. The same high standards required in Columbia’s external reporting apply to financial reports to management. Accruals and estimates included in internal reports (such as business plans, budgets, and forecasts) shall be supported by appropriate documentation and based on good-faith judgment. B. Public Disclosure Columbia is committed to providing full, fair, accurate, timely and understandable disclosure in the filings it makes with any federal or state bank regulatory authority and the Securities and Exchange Commission and in its other public communications. You are expected to support this commitment by complying with our internal and financial control processes and using your best efforts to ensure that the information you compile or maintain is accurate and complete. Each of us is responsible for reporting any complaints or concerns relating to accounting, internal accounting controls, auditing matters or questionable financial practices. Consult Columbia’s Policy for Complaints Regarding Accounting and Auditing Matters as to process for reporting such matters. C. Accounting Practices All payments made by or on behalf of Columbia must be documented accurately and completely in the accounting records with appropriate approval(s) and an adequate description of the business purpose of the disbursement. All cash received by Columbia shall be promptly, accurately, and completely recorded in the accounting records and deposited in a bank account authorized by Columbia. All bank accounts and other cash accounts shall be completely and accurately recorded in the accounting records. No unrecorded accounts, funds or assets shall be established for any purpose.

7 D. Cooperation with Inquiries Employees shall provide complete and accurate information in response to inquiries from Columbia’s internal and outside independent auditors as well as Columbia’s legal counsel. III. Protecting Columbia’s Assets A. Use of Company Assets Columbia’s assets are to be used exclusively in the pursuit of Columbia’s business except for minimal use authorized by your supervisor/manager. Columbia’s assets include equipment, facilities, supplies, services such as telephones and computer networks, and the time and efforts of its employees. You should not use Columbia assets for personal gain or convenience or make Columbia assets available for the gain or convenience of anyone else, or for any purpose other than conducting Columbia’s business unless you have management authorization to do so. B. Authority to Make Commitments Only specific employees are authorized to make financial or other commitments on behalf of Columbia. Commitments might be such things as approving a loan or other extension of credit, ordering equipment or materials, authorizing business travel, approving payment of an invoice or expense report, authorizing budgets or budget overruns, signing leases or other contracts, selling assets, settling litigation or other claims, borrowing money, setting compensation or employee benefits, and making charitable contributions and other transactions. These authorizations are in are governed by Company policies and procedures. You may not make commitments on behalf of Columbia without the express written authority of an executive officer to do so. C. Use of Columbia Technology As an employee of Columbia, you are provided with electronic assets to enable you to service Columbia customers. Computer networks and electronic communications systems, and all messages and log files generated on or handled by them (including backup copies), are the exclusive property of Columbia. Electronic assets may include: • Desktop, laptop or tablet computers for use at Columbia office locations or through remote access • Telephones and cell phones • Email, internet access, network resources and software • Copying, printing and fax equipment • Subscriptions to credit bureaus, proprietary and private data bases

8 You must use these resources only for the business activities of Columbia (except as otherwise permitted in Columbia’s Computer Usage Policy). These business communications are not private, and you should not expect privacy, in any of these electronic communications and interactions. Accordingly, Columbia retains the express right to monitor the content of all electronic communications by its employees, to monitor the content of server log files to review what websites or other Internet locations have been visited by employees and to monitor what information and files have been sent, received, uploaded, or downloaded. Computer networks, email systems, voice mail systems and server logs are monitored regularly to support routine and non-routine activities such as operations, maintenance, auditing, security, and investigations. You must remember that, as a matter of law, Columbia may be required to turn over this information to government agencies, law enforcement authorities and private litigants. You may not intercept or disclose, or assist in intercepting or disclosing electronic communications or Internet activity except as specifically provided above and only then with appropriate authorization. IV. Handling Confidential Information Many employees obtain knowledge or have access to confidential Company information in the course of their jobs and use it to perform assigned, authorized functions. It is vitally important that all employees handle confidential information properly. A. What is Confidential Information? What follows is not a complete list of what is considered to be confidential information, but it illustrates what is typically confidential unless it has been disclosed by Columbia in a securities filing, press release, or other authorized formal or official public communication: • Financial results, budgets, or forecasts • Business plans, operating plans, strategy statements, memos, operating manuals, organization charts and other internal communications • Columbia investments, acquisitions, or divestitures • New products, processes, or designs • Whether a product or business is meeting financial or other expectations • Business relationships or the terms of any business arrangement, including prices paid or received by Columbia • Customer data such as customer names and addresses or any confidential personal or business information of the customer • Advertising and marketing plans and campaigns • Wages and salaries, bonus or compensation plans, and personnel changes • Personal information about any employee In general, if information about Columbia or its business interactions has not been made public by Columbia, it must be treated as confidential.

9 B. Non-Disclosure and Non-Use You may not disclose to unauthorized persons any confidential information that you obtain as a result of your position with Columbia. This prohibition includes not only disclosures made to financial analysts and the media, but also business associates, family members and personal friends. It is a serious mistake to disclose such information to anyone simply because you are confident that that person will neither try to benefit from it nor disclose it to others. You may use confidential information only for legitimate Columbia business purposes. Do not use confidential information for your own personal advantage or profit, for the advantage or profit of another, or to compete with Columbia. Your obligations not to disclose Columbia’s confidential and proprietary information and not to use it for unauthorized purposes continue even after your affiliation with Columbia ends. C. Privacy of Customer Information Columbia is entrusted with important information about individuals and businesses. Our clients rely on us to maintain confidentiality and exercise prudence when dealing with their financial affairs. It is essential that you respect the confidential nature of this information. Do not attempt to access client information unless you have a legitimate business reason to do so. Columbia is legally obliged to protect the privacy of a consumer’s personal financial information. Columbia’s privacy practices are set out in our privacy policy that is circulated to our customers and made available to the public. To protect client information, we have a responsibility to securely maintain all files and records. All employees must adhere to Columbia’s Privacy Policy. D. Public Disclosures/Media/Public Appearances You may be asked for information about Columbia by the media, trade groups, consultants and others collecting information for various purposes. You must not make public statements on behalf of Columbia or provide confidential information in response to external inquiries unless you have been expressly authorized to do so by the President and Chief Executive Officer of Columbia or one of his designees (“Authorized Spokespersons”). Only Authorized Spokespersons may provide comments to the media or materials for publication, either on or off the record, and only Authorized Spokespersons may participate in meetings with investors or analysts. Prior to making speeches, giving interviews, or making public appearances on behalf of Columbia, you must consult with your supervisor or Investor Relations to ensure such activities are in compliance with Columbia’s policies on these matters.

10 E. Proper Disclosures Some employees must disclose confidential information as a part of their job responsibilities. This policy on confidential information does not prohibit such authorized disclosures. A few examples of situations in which confidential information is authorized or required to be disclosed are as follows: • Disclosure of operational data to vendors or consultants in connection with providing services to Columbia • Participation in legitimate and authorized industry surveys • Providing data to governmental agencies as part of required filings • An Authorized Spokesperson responding to media or financial analyst inquiries You should be certain that you understand what you have been authorized to disclose, and to whom, prior to disclosing any confidential information. F. Prohibition Against Internet/Social Media Disclosure It is inappropriate for any unauthorized person to disclose Columbia information or to discuss Columbia on the Internet or on social media sites, including in any forum or chat room where companies and their prospects are discussed. The posts in these forums are, in some cases, made by investors who are poorly informed, who have malicious intent, or who intend to benefit from their own stock positions. In order to avoid the disclosure of material, inside information, no director, officer or employee may discuss Columbia or Columbia-related information in an Internet forum, social media platform or chat room, regardless of the situation. G. Insider Trading Columbia prohibits anyone who possesses material non-public information concerning Columbia from trading in Columbia’s securities. You must not communicate material non- public information to people outside Columbia so that they may profit from transactions in Columbia’s securities. Material information is information that is likely to affect the market price of securities or that a reasonable investor would consider important in determining whether to buy, sell or hold a security. Information is non-public if it has not been disclosed in a manner designed to reach investors generally, such as in a publicly accessible conference call, a press release or in a filing with the Securities and Exchange Commission. Certain employees are designated as “restricted persons” and are subject to trading black-out periods and pre-clearance procedures. You will be notified by the Filing Coordinator if you are designated as a restricted person and will be provided with additional information on the particular restrictions to which you will be subject.

11 The Columbia Policy on Insider Trading provides additional information on this subject. You should contact the Filing Coordinator with any questions about buying or selling Columbia stock. V. Conflicts of Interest and Related Policies A. Conflicts of Interest You must carry out your professional responsibilities with integrity and with a sense of loyalty to Columbia. You must avoid any situation that involves a possible conflict or an appearance of a conflict of interest between your personal interests and the interests of Columbia. Knowingly acting in a manner that presents a conflict between your personal interests and the best interest of Columbia is a violation of this Code. A conflict of interest cannot be defined precisely, only illustrated. The basic factor that exists in all conflict situations is a division of loyalty between Columbia’s best interests and the personal interest of the individual. Many, but not all, conflict situations arise from personal loyalty or personal financial dealings. It is impossible to list every circumstance giving rise to a possible conflict of interest, but the following illustrates the types of situations that may cause conflicts. 1. Family Members and Other Relationships A conflict of interest may exist when Columbia does business with or competes with an organization in which a family member has an ownership or employment interest. “Family members” include a spouse, partner, parents, grandparents, children, siblings and in-laws or equivalent relationships. You may not conduct business on behalf of Columbia with family members or a company, organization, or business with which you or a family member is associated unless you receive prior written approval under this Code. With respect to the work environment, a supervisor or manager is prohibited from having an intimate relationship with any individual in his or her direct or indirect reporting chain, or with any non-employee/consultant who is assigned to perform work within the department under the supervision of a supervisor or manager. In addition, an employee may not serve in certain positions, departments, and/or functions that could allow them to intentionally or unintentionally influence, control, or affect the terms and conditions of employment of another employee – or a business relationship with a customer or vendor – who is a relative or family member, or with whom they are, or have ever been, in a relationship that may cause a conflict of interest in the workplace. Because intimate, family and business relationships between an employee and another employee, director, contractor, customer, or vendor each have the potential to cause a future conflict of interest, all such relationships must be disclosed even if an actual, apparent, or emerging conflict of interest does not currently exist.

12 2. Ownership in Other Businesses You cannot own, directly or indirectly, a significant financial interest in any business entity that does business with or is in competition with Columbia unless you receive prior written approval under this Code. As a guide, “a significant financial interest” is defined as ownership by an employee and/or family members of more than 1% of the outstanding securities/capital value of a corporation or that represents more than 5% of the total assets of the employee and/or family members. 3. Outside Employment Employees must keep outside business activities, such as a second job or self- employment, completely separate from the employee’s activities with Columbia. Employees may not use Company assets, facilities, materials, or services of other employees for outside activities unless specifically authorized by Columbia, such as for certain volunteer work. You should avoid any actual or apparent conflict of interest. Conflicts can arise unexpectedly, and prompt disclosure is critically important. You must disclose existing or emerging or potential conflicts of interest (including personal relationships that could reasonably be considered to create conflicts) to your manager or to a member of the Ethics Committee and follow the guidance provided. B. Corporate Opportunities Directors and officers of Columbia stand in a fiduciary relationship to Columbia. It is a breach of that fiduciary obligation for any such person to take advantage of a business opportunity for his or her personal profit or benefit when the opportunity is within the corporate powers of Columbia and when the opportunity is of present or potential practical advantage to Columbia unless the Board of Directors knowingly elects not to avail itself of such opportunity and the participation of the director or officer is approved in advance by the Board. In addition, you should not solicit others within Columbia, clients of Columbia, or Company suppliers to participate in, contribute to, or otherwise support the activities of your outside business activities. It is the policy of Columbia that no director or executive officer may appropriate a corporate opportunity without the written consent of the Board of Directors. C. Outside Director, Officer and Trustee Positions Engagement in our communities is a core value of Columbia. We encourage and celebrate service to our communities. Serving as an officer, board member or trustee of a local cultural, educational, social service or other not-for-profit organization does not generally require approval. However, we encourage you to discuss these roles with your manager. If you believe that a conflict may exist between serving with such organization and your role at Columbia, you should contact the Legal Department.

13 Serving as an officer or board member of a for-profit company or a governmental entity requires the approval of the Legal Department. When a transaction involving Columbia is discussed by an outside organization where you serve as an officer or director, you should disclose your relationship with Columbia and not participate in any discussion of or decision about the transaction. VI. Employment Practices A. Equal Employment Opportunity Columbia provides equal employment and advancement opportunity for all individuals in full compliance with all federal, state, and local equal employment opportunity laws and regulations. See Employee Manual at Equal Employment Opportunity. B. Harassment and Discrimination It is the policy of Columbia to provide a work environment in full compliance with all federal, state, and local laws regarding harassment because of race, color, religion, age, gender, sexual orientation, national origin, disability, or any characteristic protected by applicable law. Columbia maintains a strict policy against unlawful harassment of any kind, including sexual harassment. Columbia will vigorously enforce this policy consistent with all applicable federal, state, and local laws. See Employee Manual at Anti- Harassment Policy. C. Workplace Violence Columbia expressly prohibits any and all acts of violence or threats of violence by any Company employee or director against another employee or director, any other person in or about Company facilities or during the conduct of Company business elsewhere. You are prohibited from possessing or transferring weapons, explosives, firearms, or any other substance or materials that threaten public safety at any time while on Company property or during the conduct of Company business elsewhere, with the exception of personnel employed or retained by Columbia and who are licensed to carry firearms. D. Illegal and Impairing Substances You may not possess, use, sell, transfer, distribute or be under the influence of illegal or non-prescribed drugs while on Company property, while conducting Company business at any other location or during your working time. Such behavior is a violation of Company policy in addition to being a violation of the law. Additionally, you must be fit for duty at all times when working and may, not pose a safety hazard to yourself or others through your use of alcohol or other legal, but impairing, substances.

14 VII. Compliance with Laws and Regulations A. Our Regulatory Environment We operate in a highly regulated environment. It is important that you seek to comply with – and never intentionally violate – the laws and regulations applicable to our businesses. If you become aware of any significant legal or regulatory concerns, inform your manager or the Legal Department. Violating applicable laws and regulations exposes Columbia to risk and may result in legal proceedings and penalties including, in some circumstances, civil and criminal penalties that could affect you personally. B. Suspicious Activity Columbia has an obligation to help prevent money laundering and related criminal activity. Always know the parties with whom you are conducting business and be sure to perform all required due diligence. Be alert for transactions that are inconsistent with usual business practices or that do not match the client’s normal pattern of activity. Never cooperate with efforts to evade reporting or other legal requirements. Know the procedures in your department for reporting suspicious activity. C. Examinations, Government Investigations and Litigation 1. Regulatory Examinations Columbia is subject to examination by federal banking regulators. It is Company policy to cooperate fully with governmental regulators. 2. Government Investigations It is Company policy to cooperate with reasonable and valid requests by federal, state, or local government investigators. At the same time, Columbia is entitled to all the safeguards provided in the law for persons under investigation, including representation by counsel. Accordingly, if a government investigator requests an interview with you, seeks information or access to files, or poses written questions, he/she must be told that you must first consult Columbia’s legal counsel. Immediately thereafter, you must contact Columbia’s General Counsel, who will then provide advice as to further action. 3. Penalties You should be aware that criminal sanctions could be imposed upon any person who submits false or misleading information to the government in connection with any

15 regulatory examination or government investigation. Full cooperation and proper legal supervision of any response in connection with a regulatory examination or government investigation is essential from both corporate and individual viewpoints. 4. Litigation In the event any litigation is begun or threatened against Columbia, notify the General Counsel immediately, even if the action or threats appear to be without merit or insignificant. 5. Preservation of Records All records relating to the business of Columbia shall be retained as required by Columbia’s record retention guidelines and applicable laws. Notwithstanding such guidelines, under no circumstances shall any records known to be the subject of or germane to any anticipated, threatened, or pending lawsuit, governmental or regulatory investigation, or bankruptcy proceeding, be removed, altered, concealed, or destroyed. D. Compliance with Antitrust Laws Antitrust laws prohibit anyone from entering into agreements (e.g., verbal or written, formal or informal) that could prevent, restrict or distort competition (i.e., prevent free market forces from operating). These arrangements include price fixing, information sharing and bid rigging. If you have any questions, consult the Legal Department. E. Political Contributions and Activities All employees are encouraged to participate in the political process. However, U.S. law and certain states prohibit Columbia from making political contributions. It is the policy of Columbia that no Columbia funds or assets, including the work time of any employee, may be contributed, loaned, or made available, directly, or indirectly, to any political party, candidate, continuing political committee or any political action committee, whether local, state, or federal. Therefore, you must be careful to use your own time and resources, and never those of Columbia, for political contributions or activities. It is Columbia’s policy that employees shall observe all applicable laws regarding gifts to government officials and that no employee shall offer to make a gift or thing of value (including, but not limited to, meals, entertainment or tickets to events) to influence a government official in the performance of his or her official duties.

16 F. Bribes, Illegal Payments, Gifts and Gratuities Pursuant to the duties and responsibilities provided for in the Bank Bribery Amendments Act of 1985 (the “Bank Bribery Act”)1, it is a federal crime for anyone to corruptly give anything of value to a director, officer, employee, or agent of a bank with the intention of influencing that person. It is also a crime for any person to offer, or for any employee to solicit for themselves or a third party, anything of value with the intention of being influenced, regardless of whether anything is actually received. The U.S. government and state governments have various regulations prohibiting government personnel from accepting entertainment, gifts, gratuities, or other business courtesies that may be acceptable in the private commercial sector. Directors, officers and employees of Columbia shall not solicit, accept, or retain a gift – including any merchandise, loan, legacy, service, gratuity, or favor -- from any customer of Columbia, or from any other individual or organization doing, or seeking to do, business with Columbia except if: (i) there is, and appears to be, no reasonable likelihood that such director, officer or employee would be improperly influenced in the performance of their duties on behalf of Columbia; and (ii) acceptance of such gift falls within one of the exceptions set forth below.” The following transactions are permitted exceptions to the general prohibition against accepting things of value: • Gifts, gratuities, amenities, or favors, when the motivating factor is based on a family or personal relationship that exists independently of Company business • Gifts for commonly recognized events or occasions, such as a promotion, retirement, holiday, wedding, or birthday, as long as the gifts are of reasonable value (employees should contact their supervisor to the extent there are any questions) • Meals, refreshments, entertainment, accommodations and travel arrangements in furtherance of a bona fide business discussion, or other occasion for the primary purpose of enhancing business relations; however, such meals, refreshment, entertainment, accommodation or travel arrangement must be of reasonable value, such that expenses related thereto would have been fully paid by Columbia had it not been paid by another party

17 • Advertising or promotional materials of reasonable value, such as pens, pencils notepads, key chains, calendars, and other reasonable value items • Discounts or rebates on merchandise or services that are available to other customers • Benefits that are available to the general public under similar conditions • Loans from other banks or financial institutions to finance, on customary terms, proper and usual activities of directors, officers, or employees, such as residential mortgage loans, except where such loans are prohibited by law • Awards recognizing service and accomplishment from civic, charitable, educational, or religious organizations. If you are offered or receive something of value beyond what is permitted in this Code, you must obtain prior written approval from the Ethics Committee before you may accept or keep it. Transactions other than those described above may be approved on a case- by-case basis so long as approval is consistent with the Bank Bribery Act. If you are at all uncertain as to whether you may accept something of value, you must ask an executive officer or a member of the Ethics Committee. 1 The Bank Bribery Act, in general, prohibits the giving or receiving of gifts or other things of value to or by bank directors, officers, or employees with the intent to corruptly influence the bank’s business. The Act states, in relevant part, “Whoever 1. corruptly gives, offers or promises anything of value to any person, with intent to influence or reward an officer, director, employee, agent, or attorney of a financial institution in connection with any business or transaction of such institution; or 2. as an officer, director, employee, agent, or attorney of a financial institution, corruptly solicits or demands for the benefit of any person, or corruptly accepts or agrees to accept anything of value from any person, intending to be influenced or rewarded in connection with any business or transaction of such institution; shall be fined not more than $1,000,000 or three times the value of the thing given, offered, promised, solicited, demanded, accepted, or agreed to be accepted, whichever is greater, or imprisoned not more than thirty years, or both, but if the value of the thing given, offered, promised, solicited, demanded, accepted, or agreed to be accepted does not exceed $1,000, shall be fined under this title or imprisoned not more than one year or both. (See, Guidelines for Compliance with the Federal Bank Bribery Act https://www.fdic.gov/regulations/laws/rules/5000- 2300.html.) Approved by the Board of Directors on April 29, 2025

A APPENDIX A PROCEDURES FOR HANDLING COMPLAINTS REGARDING ACCOUNTING, INTERNAL CONTROLS AND AUDITING MATTERS

1 COLUMBIA FINANCIAL, INC. AUDIT COMMITTEE PROCEDURES FOR HANDLING COMPLAINTS REGARDING ACCOUNTING, INTERNAL CONTROLS AND AUDITING MATTERS The Audit Committee of the Board of Directors of Columbia Financial, Inc. (the “Company”) hereby establishes the following procedures for: 1. The receipt, retention and treatment of complaints received by the Company regarding accounting, internal accounting controls, auditing matters or other financial matters; and 2. The confidential, anonymous submission by employees of the Company of concerns regarding questionable accounting, auditing matters or other financial matters. Submission Any employee, stockholder, officer, director or other interested party who has any complaint or concern regarding any accounting, internal accounting controls or auditing matter relating to the Company (a “Reporting Individual”) may report such complaint or concern directly to the Chairman of the Audit Committee of the Board of Directors (the “Audit Committee Chairman”). Stockholders and other interested parties shall be directed to submit their complaints or concerns to: Chairman of the Audit Committee Columbia Financial, Inc. 19-01 Route 208 North Fair Lawn, New Jersey 07410 Such communications will be forwarded directly to the Audit Committee Chairman. Employees may submit any such complaint or concern as follows: • In writing via U.S. mail addressed to the attention of the Audit Chairman, Columbia Financial, Inc., 19-01 Route 208 North, Fair Lawn, New Jersey 07410 • Via email to the Audit Committee Chairman at mmassood@massood.com • Via telephone to the Audit Committee Chairman at (973) 220-3068.

2 In addition, an employee may report any such complaint or concern through one of the following mechanisms: • the Company’s Hotline at (866) 861-4527 • via email at ColumbiaFinancial@integritycounts.ca • Via the Internet at https://www.integritycounts.ca/org/ColumbiaFinancial An employee may report his or her concerns on an anonymous and confidential basis. However, the Audit Committee encourages you to provide contact information with your submission to facilitate follow-up, clarification and assistance with investigation, if necessary. Any complaint or concern submitted anonymously will, subject to the following paragraph, be kept in confidence, except that the Audit Committee may report the matter (without identifying the source) to other members of the Board of Directors, the President and Chief Executive Officer, the Chief Financial Officer and others within the Company who are responsible for investigating, evaluating, addressing or resolving the complaint or concern. Under certain circumstances, the matter that forms the basis for such complaint or concern may be required to be reported to a federal or state governmental or regulatory authority or disclosed to stockholders or the public. Any such determination to report the basis for such complaint or concern shall be made by the Audit Committee Chairman after consultation with counsel. In the event the basis for such complaint or concern is reported, the identity of the Reporting Individual will not be disclosed without his or her consent, unless required by law. Reporting Individuals shall also have the option to report complaints or concerns directly to the appropriate members of management as provided in the Company’s Code of Ethics and Business Conduct, or as otherwise announced hereafter by the Company. Matters Covered by These Procedures These procedures relate to complaints and concerns about questionable accounting, internal accounting controls or auditing matters involving the Company, including, without limitation, the following: 1. Any fraud or misstatement or omission in any financial statement of, or other financial information published by, the Company, including any report or document filed by the Company with the Securities and Exchange Commission or other governmental or regulatory authority; 2. Any error or misconduct in the preparation, evaluation, review or audit of any of the Company’s financial statements; 3. Any fraud or misstatement or omission in the recording and maintaining of the financial records of the Company;

3 4. Any weakness or deficiency in or noncompliance with the Company’s internal accounting controls; 5. Any misrepresentation or false statement made to or by a senior officer or accountant regarding a matter contained in, or required to be contained in, the financial records, financial statements, financial reports or audit reports of the Company; 6. Any deviation from full and fair reporting of the Company’s financial condition, results of operations or cash flows; 7. Any effort to mislead, deceive, coerce or fraudulently influence any internal or independent accountant or auditor in connection with the preparation, examination, audit or review of any financial statement or records of the Company; 8. Any other error, deficiency or weakness in the Company’s financial statements, internal controls, auditing procedures or financial records or reports; or 9. Any matter or conflict of interest regarding the Company's independent registered public accounting firm that may threaten their independence. This policy is in addition to the Company’s Code of Ethics and Business Conduct, which describes the procedures for reporting any illegal or unethical behavior outside the scope of this policy. Handling of Complaints Upon receipt of a complaint or notice of the nature indicated above, the Audit Committee Chairman will report the matter to and consult with a responsible officer (the “Responsible Officer”) to ensure that he or she is fully apprised of the matter and will notify legal counsel of receipt of such complaint or notice. For purposes of these procedures, the Responsible Officer will be any officer of the Company as the Audit Committee may designate, either generally or with respect to a particular matter. Under the oversight of the Audit Committee, the Responsible Officer will conduct an investigation of the matter, summarize his or her findings and conclusions in a written report to the Audit Committee and legal counsel and promptly take, or cause to be taken, any action that may be required to resolve properly the matter which is the basis for the complaint or concern. If the complaint or notice relates to a weakness or deficiency in any of the Company’s internal controls or accounting systems, the Company’s President and Chief Executive Officer (or other person designated by the Audit Committee) will oversee any necessary strengthening and/or correction of such weakness or deficiency. If the complaint or concern relates to a misstatement, error or omission in any of the Company’s financial statements, or in any report or other document filed by the Company with the Securities and Exchange Commission or other federal or state governmental or regulatory authority, the President and Chief Executive Officer or other person

4 designated by the Audit Committee will oversee the prompt correction or restatement of such financial statement, report or document and, if necessary, will cause any and all amendments to any previously filed reports or documents that may be necessary to correct any such misstatement, error or omission. Any other matters reported will be addressed and resolved in accordance with applicable law and accounting or auditing standards. The Responsible Officer will keep the Audit Committee Chairman and legal counsel informed of his findings and progress. Upon completion of the investigation and any necessary corrective action, the Responsible Officer will prepare and submit to the Audit Committee a final report on the matter. The report will describe in reasonable detail the complaint or concern reported, the results of the investigation, the conclusions reached and any corrective action taken. If no corrective action was taken, the report will include an appropriate explanation to support the decision to take no action. The Audit Committee Chairman will respond in writing to the person reporting the matter, if known, advising such individual of the results of the investigation and of any corrective action taken or, if no such action was taken, the reasons why no action was taken. A copy of the final report, including all related materials, and response to the Reporting Individual will be delivered to legal counsel. Retention of Complaints and Reports of Resulting Action The Audit Committee will maintain a file of all complaints and concerns reported pursuant to these procedures, tracking their receipt, investigation, evaluation and resolution, and of the related reports issued in connection therewith, which summarize the results of the related investigation and any corrective action taken. Copies of all such materials will be retained for at least five (5) years from the date on which the related complaint or concern was initially reported. At least annually, the Audit Committee will provide the Company’s Nominating/Corporate Governance Committee with copies of any complaints and concerns it receives, summaries of its investigation and any corrective action taken, without identifying the source, if appropriate. Legal Counsel and Other Experts In discharging their responsibilities, the Audit Committee and the Responsible Officer may request and obtain assistance from members of the Company’s accounting department, internal audit function or legal department and may retain an independent accountant, independent legal counsel or other experts to assist in the investigation of the complaint or reported concern and the implementation of the appropriate remedial or corrective action. The Company shall pay the cost of retaining any such advisor or expert.

5 Protection of Reporting Individual The Company will not discharge, demote, suspend, threaten, harass or in any other manner discriminate or retaliate against any person by reason of his or her having made any such complaint, or having reported any such concern, in good faith pursuant to and in accordance with these procedures. It shall be a violation of Company policy for any person to take any such action. Approved by the Board of Directors on January 28, 2025